CVE-2026-54449: high-severity vulnerability in langbot-app LangBot
LangBot: Authenticated RCE Via MCP Configuration
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 0.7%
LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or change an STDIO MCP server configuration without an adequate authorization boundary. In src/langbot/pkg/provider/tools/loaders/mcp.py, StdioServerParameters accepts the configured command and arguments and starts a server-side subprocess on the LangBot server. An attacker who can sign up or obtain an account can use the Extensions MCP configuration to execute arbitrary commands with the privileges of the LangBot service, enabling data disclosure, modification, and service disruption. No fixed version is available as of this review.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
langbot-app · LangBotRelated CVEs — langbot-app LangBot
In the same product, most dangerous first.
CVE-2026-90562CRITICALLangBot before 4.10.11 Authentication Bypass via Weak Recovery KeyEPSS 0.7%CVE-2026-90938HIGHLangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocketEPSS 0.6%CVE-2025-59835HIGHLangBot has a cross-directory file upload vulnerability, which could lead to system takeoverEPSS 0.4%CVE-2026-28509MEDIUMLangBot has a Cross Site Scripting(XSS) VulnerabilityEPSS 0.2%CVE-2026-112265HIGHLangBot through 4.11.0 Missing Lark/Feishu Webhook Authenticity VerificationEPSS 0.2%